EUVD-2025-17742CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
6DescriptionNVD
Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network.
AnalysisAI
Network-accessible denial-of-service vulnerability in Microsoft's Local Security Authority Server (lsasrv) caused by improper access control (CWE-284). An unauthenticated remote attacker can exploit this with low complexity to render the LSA service unavailable, affecting authentication and security policy enforcement on affected Windows systems. The CVSS 7.5 severity reflects the high availability impact; however, real-world risk depends on EPSS score, KEV candidacy status, and active exploitation data not provided in the source materials.
Technical ContextAI
The Local Security Authority Server (lsasrv) is a critical Windows system service responsible for user authentication, password changes, and security policy enforcement. It operates as a privileged system process and manages sensitive security tokens and credentials. CWE-284 (Improper Access Control) indicates the vulnerability stems from insufficient authorization checks—specifically, the service likely fails to properly validate incoming network requests, allowing an unauthenticated remote attacker to trigger resource exhaustion, infinite loops, or crash conditions via malformed or repeated requests. The service's network accessibility (AV:N) combined with lack of privilege requirements (PR:N) and no user interaction (UI:N) means any remote network actor can trigger this without authentication, making it a direct threat to Windows domain infrastructure and standalone systems.
RemediationAI
- Apply Microsoft security patches for CVE-2025-33056 immediately upon availability (check Microsoft Update, Windows Update, or WSUS). 2. Prioritize patching domain controllers and authentication servers first. 3. Interim mitigations (if patch unavailable): restrict network access to LSA-related ports/services via firewall rules; implement network segmentation to limit which systems can reach LSA services; disable remote access to LSA if operationally feasible. 4. Monitor system event logs (Windows Security event ID 4719, 4625, and service-related errors) for exploitation attempts or LSA service crashes. 5. Consult Microsoft Security Response Center (MSRC) advisories for version-specific guidance. Patch availability and KB article numbers should be verified at Microsoft's official security updates page.
More from same product – last 7 days
{filename} endpoint. The flawed traversal guard only rejects forward slashes and '..' sequences, so absolute Windows pat
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Share
External POC / Exploit Code
Leaving vuln.today